I’m inserting the following or similar script code into these fields:

<div id="74349861627"><script type="text/JavaScript" src="https://www.aparat.com/embed/vdblggf?data%5Brnddiv%5D=74349861627&data%5Bresponsive%5D=yes"></script></div> However, these codes aren’t executing. How can I fix this issue?

<h2>(<?php the_field(‘partistname’,$term) ?>)</h2>

</h1><h2 style="display: none;">(<?php the_field(‘partistname’,$term) ?>)</h2>

Specifically, we will escape the WYSIWYG field BEFORE oembed’s are processed, so if your WYSIWYG field literally contains a youtube URL for example, this will still be turned into an iframe for the YouTube video correctly.

In our testing it comes through as much more complicated.

Setup:

• WordPress 6.5.4, ACF Pro 6.3.3
• The field is ‘content’ and is a WYSIWYG field nested within a Layout as part of a Flexible Content Field.
• The content is like:

  
  Overview of what's in the video. See video here:

https://www.youtube.com/watch?v=Z8ykNnIK1Ik

Database:
We confirmed that the DB has the plain text version stored as-is

Code:
- `echo get_sub_field('content', false, false);` returns the same plain-text version
- `echo get_sub_field('content');` does indeed return the proper iframe so it can be displayed on-page BUT THIS IS THE EXACT SAME SECURITY HOLE as the editor can now add iframes that are displayed on-page.
- `echo acf_esc_html(get_sub_field('content'));` (which is what you suggest we should be doing for proper security) strips the YouTube video altogether (since it populates then strips the iframe)

Ideally editors should be able to add plain-text URLs through oEmbed which will then be safely hydrated and displayed while being unable to attack the site through malicious submissions.

If other users disagree, please add your thoughts but here's what we see:

Scenario 1: User does everything properly in a WYSIWYG, embeds videos and images, and adds text.
Scenario 1 outcome: The content is displayed as it shows in WP-Admin (adding whatever CSS is part of the theme)

Scenario 2: Along with the same content from scenario 1, User tries to do something malicious and successfully commits a bad iframe to the DB.
Scenario 2 outcome: The bad output is stripped and the rest of the content displays as intended. (bonus: hopefully we get an admin warning about this)

So nothing has broken.. and all is well / safe(?) – BUT I get the reminder/warning message each and every time. Is that because I need to take more action – or if not, can it be disabled somehow? No plans to use this field any more extensively than now..

— $post = get_post(get_the_id()); $author_id = $post->post_author; if( !empty(getfield(‘test’,’user‘.$author_id)) ){ $nametest = getfield(‘test’,’user‘.$author_id); $authorurl = get_author_posts_url($author_id); echo ”.$authorurl.”.$nametest.”; } — — $post = get_post(get_the_id()); $trad_ext = get_field(‘namedemo’,$post); if( !empty($trad_ext) ){ if($trad_ext==’en’){ $postobj = get_field(‘namedemo_en’,$post); echo ‘<div class="namedemo_art"><a class="en" href="’.get_permalink($postobj).’">Read in English</a></div>’; } if($trad_ext==’it’){ $postobj = get_field(‘namedemo_it’,$post); echo ‘<div class="namedemo_art"><a class="it" href="’.get_permalink($postobj).’">Read</a></div>’; } } —

I have this special message using a shortcode on an URL field, rendering via a shortcode on a custom post type page.

I dont rly get how I fix this ? It dont have any iframe, script or stuff like that, its just a normal https URL.

Hope you can help !